Wire feedback to IIS reverse-proxy -> Power Automate

- Set FEEDBACK_ENDPOINT to same-origin /api/feedback (no CORS, hides trigger URL)
- Add web.config with ARR/URL-Rewrite proxy rule (placeholder trigger URL),
  HTTPS/POST/static-content setup
- DEPLOYMENT.md: concrete IIS + Power Automate steps and the HTTP-trigger
  Request Body JSON Schema matching the app payload

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DEPLOYMENT.md

@@ -78,12 +78,55 @@ app.listen(8080);
 Each line of `feedback.jsonl` is one submission; download it anytime. (PHP/
 Python/ASP.NET equivalents are a few lines too.)
 
-#### Option B — Microsoft Power Automate → SharePoint / Excel (good fit for M365)
+#### Option B — Internal IIS reverse proxy → Power Automate (the chosen setup)
+
+The browser posts to a **same-origin** path `/api/feedback`; IIS forwards that to
+the Power Automate trigger. This avoids CORS entirely and keeps the secret
+trigger URL off the client. `FEEDBACK_ENDPOINT` is already set to
+`/api/feedback`, and [`web.config`](web.config) contains the proxy rule.
+
+**On the IIS box (one-time, server admin):**
+1. Install the **URL Rewrite** and **Application Request Routing (ARR)** modules.
+2. Enable the proxy: IIS Manager → server node → *Application Request Routing
+   Cache* → *Server Proxy Settings* → check **Enable proxy**.
+3. Bind the site to **HTTPS** with an internal certificate.
+4. In `web.config`, replace `POWER_AUTOMATE_TRIGGER_URL` with the real trigger
+   URL (write every `&` as `&`).
+
+**In Power Automate:**
 1. Create a flow with the **"When an HTTP request is received"** trigger.
-2. Paste its generated URL into `FEEDBACK_ENDPOINT`.
-3. Add an action: **Add a row into a table** (Excel) or **Create item**
-   (SharePoint list), mapping the JSON fields (`type`, `name`/`author`, `text`,
-   `submittedAt`, `page`, …).
+2. Set its **Request Body JSON Schema** to:
+
+   ```json
+   {
+     "type": "object",
+     "properties": {
+       "app":         { "type": "string" },
+       "page":        { "type": "string" },
+       "submittedAt": { "type": "string" },
+       "type":        { "type": "string" },
+       "name":        { "type": "string" },
+       "author":      { "type": "string" },
+       "text":        { "type": "string" },
+       "step":        { "type": "integer" },
+       "view":        { "type": "string" },
+       "timestamp":   { "type": "string" },
+       "ts":          { "type": "string" },
+       "id":          { "type": "string" },
+       "clientId":    { "type": "string" }
+     }
+   }
+   ```
+   > `name` is used by the home/SOP forms, `author` by the Work Package Creator.
+   > Map both into one "Submitted by" column with an expression like
+   > `coalesce(triggerBody()?['name'], triggerBody()?['author'])`.
+3. Add an action — **Create item** (SharePoint list) or **Add a row into a
+   table** (Excel / Dataverse) — mapping the fields above.
+4. Save; copy the generated **HTTP POST URL** into `web.config`
+   (`POWER_AUTOMATE_TRIGGER_URL`).
+5. A Power App (or just the list/Excel) reads that store to show live comments.
+
+Chain: `browser → /api/feedback (IIS proxy) → Power Automate → SharePoint/Dataverse → Power App`.
 
 The "downloadable file" is then just the Excel/SharePoint list, viewable live or
 exported — all inside your corporate cloud.